Hi,
Simple setup:
Host A:
My goal is to be able to access the PostgreSQL database(s) from the public internet.
I setup PostgreSQL successfully in a way that I can access it from any other machine on the same private network successfully.
The next logical step was to modify my host A's pf configuration and add some port forwarding to it:
At this point I expected to be able to just login into the database server from anywhere I'd like too. But oh boy was I mistaken.
An entire day later I am still unable to figure out what's wrong here.
Symptoms:
Here's the full /etc/pf.conf of host A:
On host B, I ensure that PostgreSQL is listening on the correct interface (postgresql.conf):
And the corresponding pg_hba.conf allows remote connections using password authentication:
So, given the symptoms i think it's pretty safe to assume that it's not a PostgreSQL configuration issue but instead something related to the routing/filtering/forwarding on host A.
I'd be thankful for any kind of input that might help tracking down & solving this problem.
At this point I'd also like to thank DanDare from freenode for already having taken the time looking into this.
Simple setup:
Code:
Internet ------ Host [A] ------ Host [B]- Is a simple firewall/gateway/router/DNS server
- Runs PF & HAproxy
- Has the private network IP address 192.168.7.1
- Connects to the ISP's gateway on the other end
- Is running databases/postgresql11-server.
- Has the private network IP address 192.168.7.239
My goal is to be able to access the PostgreSQL database(s) from the public internet.
I setup PostgreSQL successfully in a way that I can access it from any other machine on the same private network successfully.
The next logical step was to modify my host A's pf configuration and add some port forwarding to it:
Code:
rdr pass on $if_wan0 proto tcp from any to any port 5432 -> 192.168.7.239An entire day later I am still unable to figure out what's wrong here.
Symptoms:
- Host A is a gateway that is already running in that very network almost two years. It also runs HAproxy and manages several web servers behind it (in the same network as my new PostgreSQL instance is located. Everybody is able to call up those websites --> The overall networking & routing appears to be working.
- Running tcpdump() on host A I can see the incoming packages on the external interface on port 5432. However, I can't see any packages with port 5432 on the interface connected to the internal network - This makes me suspect that it's a PF configuration issue.
Here's the full /etc/pf.conf of host A:
Code:
# Define interfaces
if_lan0="igb0" # Management
if_lan1="igb1" # DNS access
if_lan2="igb2" # Client gateway 1
if_wan0="igb3" # Swisscom modem
if_pfsync="igb4" # PFsync
if_loc0="lo0" # Loopback
# Define networks
serversnet = $if_lan2:network
# Define ports
allowed_ports_in_tcp = "{ ssh, http, https }"
allowed_ports_out_tcp = "{ ssh, http, https }"
allowed_ports_udp = "{ domain, ntp }"
allowed_icmp_types = "{ echoreq, unreach }"
# Options
set block-policy drop
# Scrub
scrub in all
# Ignore loopback interface
set skip on $if_loc0
# NAT
nat on $if_wan0 inet from $serversnet to any -> ($if_wan0) static-port
# Redirects
rdr pass on $if_wan0 proto tcp from any to any port 5432 -> 192.168.7.239 port 5432
rdr pass on $if_wan0 proto tcp from any to any port 10051 -> 192.168.7.14 port 10051
rdr pass on $if_wan0 proto tcp from any to any port 2200 -> 192.168.7.235 port 22
rdr pass on $if_wan0 proto tcp from any to any port 2201 -> 192.168.8.16 port 22
# Deal with bruteforcers
table <bruteforce> persist
block quick from <bruteforce>
# Antispoof everything!
antispoof for {$if_lan0, $if_lan1, $if_lan2, $if_wan0}
# Let the whitelisting begin...
block all
# Whitelisting...
pass quick on $if_pfsync proto pfsync keep state (no-sync)
pass from {self, $serversnet} to any keep state
pass quick proto { tcp, udp } to port $allowed_ports_udp
pass inet proto icmp icmp-type $allowed_icmp_types
pass in on {$if_lan1 $if_wan0} proto tcp from any to any port {http, https, 8006, 54899, 54900} keep state
pass in quick on $if_lan2 proto tcp from $serversnet to $if_wan0:network port $allowed_ports_in_tcp keep state
pass proto tcp from $serversnet to port $allowed_ports_out_tcp keep state
pass in quick on {$if_lan0, $if_wan0} proto tcp from any to any port 22 flags S/SA keep state (max-src-conn 10, max-src-conn-rate 50/3600, overload <bruteforce> flush global)
pass out on $if_lan2 proto tcp from any to $serversnet port 22 keep stateOn host B, I ensure that PostgreSQL is listening on the correct interface (postgresql.conf):
Code:
listen_addresses = 'localhost, 192.168.7.239'And the corresponding pg_hba.conf allows remote connections using password authentication:
Code:
# TYPE DATABASE USER ADDRESS METHOD
# "local" is for Unix domain socket connections only
local all all trust
# IPv4 local connections:
host all all 127.0.0.1/32 trust
# IPv6 local connections:
host all all ::1/128 trust
# Allow replication connections from localhost, by a user with the
# replication privilege.
local replication all trust
host replication all 127.0.0.1/32 trust
host replication all ::1/128 trust
host all all 0.0.0.0/0 md5So, given the symptoms i think it's pretty safe to assume that it's not a PostgreSQL configuration issue but instead something related to the routing/filtering/forwarding on host A.
I'd be thankful for any kind of input that might help tracking down & solving this problem.
At this point I'd also like to thank DanDare from freenode for already having taken the time looking into this.
